CVE-2015-3246
Red Hat Libuser Race Condition Vulnerability
Description
CVE-2015-3246 is a medium-severity vulnerability in libuser, the Red Hat library used by the userhelper program from the usermode package, which directly modifies /etc/passwd rather than using a safe update procedure. A local user can cause an error during that modification and leave the file in an inconsistent state, producing a denial of service on the system's account database. The NVD entry notes explicitly that this issue can be combined with CVE-2015-3245 to gain privileges, which is what elevates a file-consistency bug into a local privilege escalation chain. libuser before 0.56.13-8 and 0.60 before 0.60-7 are affected, across Red Hat Enterprise Linux 5, 6 and 7 and openSUSE 13.2. Despite its age and a CVSS score of only 5.1, CVE-2015-3246 has an EPSS score of roughly 8.8% at the 94th percentile and was added to the CISA Known Exploited Vulnerabilities (KEV) catalog.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| redhat | enterprise linux | 5.0; 6.0; 7.0 |
| opensuse | opensuse | 13.2 |
| libuser project | libuser | < 0.56.13-8; >= 0.60, < 0.60-7 |
References
- http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163044.html(Broken Link)
- http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162947.html(Broken Link)
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00000.html(Mailing List, Third Party Advisory)
- http://rhn.redhat.com/errata/RHSA-2015-1482.html(Vendor Advisory)
- http://rhn.redhat.com/errata/RHSA-2015-1483.html(Vendor Advisory)
- http://www.securityfocus.com/bid/76022(Third Party Advisory)
- http://www.securitytracker.com/id/1033040(Third Party Advisory)
- https://access.redhat.com/articles/1537873(Mitigation, Vendor Advisory)
- https://www.exploit-db.com/exploits/44633/(Third Party Advisory, VDB Entry)
- https://www.qualys.com/2015/07/23/cve-2015-3245-cve-2015-3246/cve-2015-3245-cve-2015-3246.txt(Exploit)
- https://blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-3246(US Government Resource)
Weakness Type
CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
A TOCTOU race condition occurs when a program checks the state of a resource and then acts on it, while the state can change in between — invalidating the check. This weakness is especially dangerous in setuid programs such as userhelper, which run with elevated privileges on behalf of unprivileged users: a local attacker who can influence timing during the direct modification of /etc/passwd can steer the privileged process into leaving the file in a state the code never validated.
Learn more: CWE-367 — Time-of-check Time-of-use (TOCTOU) Race Condition
CWE-264: Permissions, Privileges, and Access Controls
This is the broader legacy category for failures in the assignment and enforcement of permissions and privileges. Here it captures the underlying problem that a setuid helper modifies a privileged system file directly, so a defect in that handling crosses the boundary between unprivileged users and the system account database.
Learn more: CWE-264 — Permissions, Privileges, and Access Controls
Impact Analysis
CVE-2015-3246 requires local access and has High attack complexity because the attacker must cause an error at the right moment during the /etc/passwd modification; notably no privileges are required beyond being a local user, and no user interaction is needed. Taken alone the impact is limited to availability, rated High, with no confidentiality or integrity impact — the direct consequence is an inconsistent /etc/passwd, which can prevent authentication, break account lookups and effectively lock users out of the system. The reason this vulnerability matters far more than a 5.1 score suggests is the explicit chaining note in the NVD description: combined with CVE-2015-3245, the same defective handling becomes part of a local privilege escalation to root. On multi-user Linux systems — shared servers, jump hosts, legacy RHEL 5/6/7 installations still in production — that turns an obscure file-consistency issue into a route from any shell account to full system control. The EPSS score of about 8.8% in the 94th percentile is strikingly high for a decade-old medium-severity flaw and reflects that the chained technique remains in active use.
Exploit Maturity
Despite dating from 2015, CVE-2015-3246 has strong current exploitation signals. Public exploit material is available: Qualys published the original research covering CVE-2015-3245 and CVE-2015-3246, which is tagged as an exploit reference and documents the chained privilege escalation in detail, and Exploit-DB entry 44633 provides a packaged exploit. CISA has confirmed active exploitation through its KEV listing, and Cisco Talos references this vulnerability in its research on UAT-10147, a Chinese-speaking adversary integrating agentic AI into post-compromise operations — evidence that it remains part of modern post-compromise tooling against legacy Linux hosts. The EPSS score of approximately 8.8% in the 94th percentile is remarkable for a decade-old Medium-severity vulnerability and confirms that attackers still find unpatched targets. Note that the SecurityFocus reference in the advisory points to a dead host; the Qualys and Exploit-DB sources above are the authoritative technical record.
Remediation
- Follow the CISA KEV required action. Apply mitigations in accordance with Red Hat's instructions, comply with CISA's BOD 26-04 "Prioritizing Security Updates Based on Risk" guidance and the "Forensics Triage Requirements", and discontinue use of the product if mitigations are unavailable. The KEV due date of 9 September 2026 has passed.
- Update libuser to a fixed package. Fixed versions are libuser 0.56.13-8 and 0.60-7; apply the vendor errata RHSA-2015:1482 and RHSA-2015:1483 for Red Hat Enterprise Linux 5, 6 and 7, or the corresponding openSUSE update for 13.2. Patch CVE-2015-3245 at the same time, since the privilege escalation depends on the pair.
- Apply Red Hat's documented mitigation where patching must wait. Red Hat published mitigation guidance for this issue; the practical measure is to remove the setuid bit from
userhelperor restrict its execution to a trusted group, which closes the path for ordinary local users at the cost of the convenience featuresuserhelperprovides. - Locate legacy systems still running affected packages. The affected platforms — RHEL 5, 6 and 7 and openSUSE 13.2 — are long past mainstream support, so the real task is inventory: identify unmanaged or forgotten hosts, appliances with embedded RHEL, and long-lived VMs, and prioritise any system where untrusted users hold shell access.
- Monitor for abuse and harden long term. Alert on unexpected modifications to
/etc/passwdand/etc/shadow, onuserhelperandchfn/chshinvocations by unusual accounts, and on new root-privileged processes spawned from user sessions; then reduce exposure by removing unnecessary setuid binaries across the estate, migrating off end-of-life distributions, and — as the general defence against TOCTOU — ensuring privileged code uses atomic operations and file-descriptor-based access rather than re-resolving paths between check and use.
Technical Details
CVE-2015-3246 stems from libuser modifying /etc/passwd directly instead of using the conventional safe pattern of writing a temporary copy and atomically replacing the original. If an error occurs partway through that in-place modification, the file is left in an inconsistent state — the denial of service described in the advisory. The weakness is classified as a TOCTOU race condition (CWE-367) alongside the broader permissions category (CWE-264), because the window between libuser's validation of the file state and its completion of the write is exactly the interval a local attacker manipulates. The privileged context is userhelper from the usermode package, a setuid program that unprivileged users may invoke; that is what makes a library-level file-handling defect a security boundary issue rather than a robustness bug. The CVSS vector CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H records a local attack with high complexity, no privileges and no user interaction, and impact confined to availability. The privilege escalation the NVD note refers to comes from pairing this with CVE-2015-3245, where the inconsistent-state primitive is directed at obtaining root.
Frequently Asked Questions
Is CVE-2015-3246 being actively exploited?
Yes. CISA added CVE-2015-3246 to its Known Exploited Vulnerabilities catalog with a remediation due date of 9 September 2026, and Cisco Talos references it in research on the Chinese-speaking adversary UAT-10147. Public exploit material from Qualys and Exploit-DB has been available since 2015, and its EPSS score of about 8.8% sits in the 94th percentile.
What products are affected by CVE-2015-3246?
libuser before 0.56.13-8 and the 0.60 line before 0.60-7 are affected, as used by the userhelper program in the usermode package. Affected platforms include Red Hat Enterprise Linux 5, 6 and 7 and openSUSE 13.2 — all long past mainstream support, which makes unmanaged legacy hosts the main exposure.
How do I fix CVE-2015-3246?
Update libuser to 0.56.13-8 or 0.60-7 via Red Hat errata RHSA-2015:1482 and RHSA-2015:1483 or the equivalent openSUSE update, and patch CVE-2015-3245 at the same time since the privilege escalation requires both. Where patching must wait, follow Red Hat's mitigation guidance by removing the setuid bit from userhelper or restricting who may execute it.
How severe is CVE-2015-3246?
CVE-2015-3246 is rated Medium with a CVSS 3.1 base score of 5.1, reflecting a local attack vector, high complexity and impact limited to availability through an inconsistent /etc/passwd. That score understates the real risk, because NVD explicitly notes the issue can be combined with CVE-2015-3245 to gain privileges — and the EPSS score in the 94th percentile plus confirmed KEV-listed exploitation show the chained attack is still used against unpatched legacy systems.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.